> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sumvin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create and manage API keys for server-to-server calls to the SIS API.

API keys authenticate server-to-server calls to the SIS API. They are organisation-scoped and not tied to a specific environment.

<Note>
  API keys are only required for server-to-server SIS API calls. If your integration passes provider JWTs directly from the browser, you don't need an API key — those requests authenticate via the JWT itself.
</Note>

## When You Need an API Key

Use an API key when your **backend server** calls the SIS API directly — for example, to look up a user's identity data, verify a <Tooltip headline="Stamped Mandate" tip="A signed authorisation a user grants for specific scoped actions — delivered on the wire as a PINT." cta="Glossary →" href="/identity/pint">Stamped Mandate</Tooltip>, or manage organisation configuration programmatically. Never expose API keys in client-side code.

## Creating a Key

1. Go to **API Keys** and click **New API key**
2. Give the key a descriptive name (e.g. `backend-production`)
3. Copy the key value — it is shown **once only** and cannot be retrieved again

<Warning>
  Store your API key securely. It is only shown at creation time. If you lose it, you will need to revoke the key and create a new one.
</Warning>

## Using a Key

Include the API key in the `Authorization: Bearer` header on SIS API requests. You don't need a separate organisation header — the key is already scoped to your organisation:

```bash theme={null}
curl https://sis.sumvin.com/v0/organisation/{organisation_id}/users \
  -H "Authorization: Bearer <your-api-key>"
```

See the [SIS API Reference](/api-reference) for the full set of endpoints that accept API key authentication.

## Revoking a Key

1. Locate the key in the **API Keys** table
2. Click **Revoke**
3. Confirm the prompt

Revocation is immediate. Any requests using the revoked key will be rejected with `401 Unauthorized`.

## Related

* [SIS API Reference](/api-reference) — full endpoint reference for server-to-server calls
* [Authentication Model](/dashboard/authentication-model) — JWT-based auth for client-side calls